CISM Practice Test 20 — 15 Questions

Question 1

Based on the exhibit, what is the most likely vulnerability that an attacker could exploit?

Accepted Answer

An attacker could use SQL injection on the web server to extract data directly from the database via the permitted MySQL traffic.. The IDS is on the DMZ-Internal segment, but it only alerts; it does not block. If an attacker compromises a web server, they can communicate with the database server without being blocked by the IDS (only alerted). Additionally, the firewall allows MySQL direct from web to database, so after compromise, the attacker can extract data. The most likely vulnerability is the lack of network segregation between web and database tiers – they are in different zones but the firewall rule permits MySQL directly, and the IDS is passive. However, the question asks for most likely exploit: an attacker could use SQL injection to compromise the web server and then pivot to the database. The IDS may detect but not prevent. So the gap is that the database is directly accessible from the web tier without any application-layer filtering. Among options, we need to pick one that correctly identifies the exploit path.

Answer

An attacker could perform a DDoS attack on the external interface to disrupt email services.

Answer

An attacker could exploit the SMTP service to send spam.

Answer

An attacker could sniff traffic on the DMZ segment to capture LDAP credentials.

Question 2

Which TWO of the following are primary objectives of a security awareness program?

Accepted Answer

Reduce the number of security incidents. Options A and B are correct. Changing employee behavior and reducing security incidents are core objectives. Option C is wrong compliance is a benefit but not the primary objective. Option D is wrong increasing budget is not an awareness objective. Option E is wrong improving password sharing is counterproductive.

Answer

Improve password sharing practices

Answer

Increase the security budget

Answer

Ensure compliance with regulations

Question 3

A large financial institution is updating its information security program to align with a new regulatory framework. The program currently has a decentralized governance model. Which of the following is the MOST significant risk of maintaining a decentralized model?

Accepted Answer

Inconsistent security levels across business units. Option B is correct because decentralized governance leads to inconsistent security levels across business units, which is a major regulatory and risk concern. Option A is possible but less critical. Option C may increase but is a consequence. Option D may be slower but inconsistent security is more fundamental.

Answer

Slower incident response

Answer

Higher cost of compliance

Answer

Duplication of controls

Question 4

A security manager is designing a metrics dashboard for executive management. Which of the following metrics is MOST useful for demonstrating the value of the security program?

Accepted Answer

Mean time to detect incidents. Option B is correct because mean time to detect incidents directly reflects the program's ability to identify threats, which is a key value indicator. Option A is operational. Option C is budget-related. Option D is output, not outcome.

Answer

Percentage of budget spent on security

Answer

Number of security patches applied

Answer

Number of security policies created

Question 5

After a data breach, the CISO is updating the incident response plan. Which of the following is MOST critical to include?

Accepted Answer

Communication templates for stakeholders. Option B is correct because communication templates ensure timely and consistent messaging to stakeholders, regulators, and the public, which is critical for managing reputation and legal exposure. Option A is wrong while important, technical procedures are less critical than communication. Option C is wrong legal hold is important but not as immediate. Option D is wrong root cause analysis is post-incident.

Answer

Technical forensic procedures

Answer

Root cause analysis methodology

Answer

Legal hold instructions for data preservation

Question 6

Refer to the exhibit. The dashboard shows the incident response plan test is overdue. What is the MOST immediate risk?

Accepted Answer

Increased likelihood of a successful breach due to untested procedures. Option A is correct because an untested plan may have invalidated procedures, increasing the likelihood of a breach during a real incident. Option B is wrong regulatory fines may result, but the immediate risk is operational. Option C is wrong recovery time is a consequence. Option D is wrong insurance impact is less immediate.

Answer

Loss of cyber insurance coverage

Answer

Regulatory fines for non-compliance with testing requirements

Answer

Extended recovery time during an incident

Question 7

An organization is developing an information security program for a new subsidiary. Which approach BEST ensures that the subsidiary's program complements the parent's?

Accepted Answer

Adopt a recognized international standard such as ISO 27001. Option D is correct because adopting a recognized international standard like ISO 27001 provides a common framework that can be tailored, ensuring consistency while allowing for local adaptation. Option A is wrong because exact replication may not fit. Option B is wrong separate assessments may create divergence. Option C is wrong outsourcing does not ensure complement.

Answer

Replicate the parent's policies exactly

Answer

Perform a separate risk assessment for the subsidiary

Answer

Outsource security management to a third party

Question 8

Refer to the exhibit. An audit reveals that 20% of privileged accounts were approved by the same manager without secondary review. Which control deficiency is MOST relevant to this finding?

Accepted Answer

Segregation of duties. Option C is correct because the lack of secondary review for privileged account approvals violates the principle of segregation of duties. Option A is wrong provisioning delay is not indicated. Option B is wrong access review frequency may be adequate. Option D is wrong log retention is unrelated to approval process.

Answer

Access review frequency

Answer

Provisioning delay

Answer

Audit log retention

Question 9

The security team is designing a security awareness program. Which topic should be prioritized FIRST?

Accepted Answer

Phishing recognition and reporting. Option A is correct because phishing is a common initial attack vector, and training users to recognize it can immediately reduce risk. Option B is wrong password policies are important but often covered later. Option C is wrong incident reporting is critical but follows awareness of threats. Option D is wrong data classification is more advanced.

Answer

Password creation and management

Answer

Incident reporting procedures

Answer

Data classification and handling

Question 10

Refer to the exhibit. The CISO wants to improve the program. Which recommendation BEST addresses the main gap shown in the dashboard?

Accepted Answer

Implement automated patching for high-risk vulnerabilities. Option C is correct because high-risk vulnerability remediation at 88% is below target; automated patching for high-risk vulnerabilities would improve this metric. Option A is wrong increasing patch frequency may not target the specific gap. Option B is wrong critical vulnerability remediation is already high. Option D is wrong reducing the target would not address the underlying issue.

Answer

Reduce the compliance target for high-risk vulnerabilities to 90 days

Answer

Focus on critical vulnerability remediation

Answer

Increase patch frequency for all systems

Question 11

An organization has implemented a new security policy requiring multi-factor authentication for all remote access. Several users complain about the inconvenience. What is the BEST course of action for the security manager?

Accepted Answer

Provide training on the importance of MFA. Option B is correct because training helps users understand the importance and reduces resistance. Option A is too drastic initially. Option C undermines security. Option D delays necessary protection.

Answer

Allow exceptions for senior executives

Answer

Delay implementation until user acceptance improves

Answer

Revoke remote access for non-compliant users

Question 12

Which THREE are components of the Plan phase in a security program lifecycle (e.g., ISO 27001 PDCA)?

Accepted Answer

Risk assessment. Risk assessment, policy development, and strategy alignment are all part of planning. Options A, B, and E are correct. Option C (implementation) belongs to the Do phase. Option D (monitoring) belongs to Check/Act.

Answer

Monitoring and review

Answer

Implementation of controls

Question 13

Which THREE of the following are common challenges in implementing an information security program across a large enterprise?

Accepted Answer

Cultural resistance to security controls from business units.. Correct answers are A, C, and E. Option A (cultural resistance to security controls) is common. Option C (legacy systems that cannot be patched) is a technical challenge. Option E (inconsistent enforcement across business units) reflects governance issues. Option B (lack of security awareness training) is a symptom but not an implementation challenge per se; training can be provided. Option D (overreliance on automated tools) is less common.

Answer

Overreliance on automated security tools.

Answer

Lack of security awareness training for end users.

Question 14

Which THREE elements are essential for an effective information security governance framework?

Accepted Answer

Clear accountability structure. Options A, B, and E are correct. Board oversight ensures strategic direction, security policies provide the foundation, and accountability structure assigns responsibility. Option C is wrong risk appetite statement is part of governance but not always considered an essential element of the framework itself. Option D is wrong free security tools are not governance elements.

Answer

Free and open-source security tools

Answer

Formal risk appetite statement

Question 15

Which THREE characteristics indicate a higher maturity level in a security program maturity model?

Accepted Answer

Continuous improvement. Options B, C, and E are correct. Continuous improvement, quantitative metrics, and automated controls are hallmarks of mature processes. Option A is wrong ad hoc processes are low maturity. Option D is wrong reactive approach is low maturity.

Answer

Reactive approach to incidents

Answer

Ad hoc processes

CISM Practice Test 20 — 15 Questions

Exhibit

CISM Practice Test 20 — 15 Questions

Exhibit